sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [Fwd: gzip directory traversal vulnerability]

From: Thomas Houssin <thomas.houssin AT gmail.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [Fwd: gzip directory traversal vulnerability]
Date: Thu, 21 Apr 2005 01:26:18 +0200

The compressed file "dir-traversal-bug.gz" will create
a file in "/tmp" when decompressed with "gunzip -N" (if vulnerable).

Fixed in grimoires.
Spell attached.

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: dir-traversal-bug.gz
Description: GNU Zip compressed data

Attachment: gzip.tar.bz2
Description: application/bzip

--- Begin Message ---

From: Imran Ghory <imranghory AT gmail.com>

To: bugtraq AT securityfocus.com

Subject: gzip directory traversal vulnerability

Date: Wed, 20 Apr 2005 20:24:42 +0100

================================
gzip directory traversal vulnerability
================================

Software: gzip
Version: 1.2.4, 1.3.3
Software URL: <http://www.gzip.org>
Platform: Unix, Linux.
Vulnerability type: Input validation
Severity: Medium, local vuln, requires user using gunzip -N on a
malicious zip file. Can result in privilege escalation.

Vulnerable software
====================

gzip 1.2.4 and 1.3.3 and previous versions running on unix.

Vulnerability
==============

Ulf Härnhammar <metaur AT telia.com> has discovered a vulnerability in
gunzip that allows a malicious zip file to extract to an arbitrary
directory of the attackers choice when gunzip is used with the -N
option.

Further details of this vulnerability are available in the Debian bug
report #305255.

Direct link: <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255>

This vulnerability can be used to make the gzip file extract to a
directory which the attacker has write access to. This vulnerability
then be used in combination with the gzip TOCTOU file-permissions
vulnerability (CAN-2005-0988, Bugtraq #12996) to change the
permissions on arbitrary files belonging to the user.

Fix
====

A patch developed by Ulf Härnhammar is linked to from the bug report
link given above.

--- End Message ---

Attachment: signature.asc
Description: OpenPGP digital signature

[SM-Security] [Fwd: gzip directory traversal vulnerability], Thomas Houssin, 04/20/2005